Exposure of WooCommerce

Ecommerce, WordPress plugins
2,628
exposure score
568,489
sites use
0
exploited
186
critical
Vexday analysis

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2,368 results
CVE-2025-26762MEDIUMWordPress WooCommerce plugin <= 9.7.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-24992MEDIUMWordPress Advanced WooCommerce Product Sales Reporting plugin <= 4.1.2 - Sensitive Data Exposure vulnerabilityEPSS 0.2%CVE-2025-48266MEDIUMWordPress Active Products Tables for WooCommerce plugin <= 1.0.6.8 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-47610MEDIUMWordPress WooCommerce Fortnox Integration <= 4.5.6 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-6729MEDIUMPayMaster for WooCommerce <= 0.4.31 - Authenticated (Subscriber+) Server-Side Request ForgeryEPSS 0.2%CVE-2024-32446MEDIUMWordPress Wallet System for WooCommerce plugin <= 2.5.9 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.2%CVE-2025-67580MEDIUMWordPress Constant Contact + WooCommerce plugin <= 2.4.1 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-69027MEDIUMWordPress Product Delivery Date for WooCommerce – Lite plugin <= 3.2.0 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-64267MEDIUMWordPress WooCommerce Ultimate Points And Rewards plugin <= 2.10.2 - Sensitive Data Exposure vulnerabilityEPSS 0.2%CVE-2026-3499HIGHProduct Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce 13.4.6 - 13.5.2.1 - Cross-Site Request Forgery to Multiple Administrative ActionsEPSS 0.2%CVE-2026-19436HIGHUltimate Gift Cards For WooCommerce < 3.2.10 - Unauthenticated Gift Card Value Inflation via Discounted PurchaseEPSS 0.2%CVE-2023-46634HIGHWordPress Custom My Account for Woocommerce Plugin <= 2.1 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.2%CVE-2025-68041HIGHWordPress Omnichannel for WooCommerce plugin <= 1.3.65 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2023-52223MEDIUMWordPress MailerLite – WooCommerce integration Plugin <= 2.0.8 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.2%CVE-2023-44995MEDIUMWordPress WooCommerce Login Redirect Plugin <= 2.2.4 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.2%CVE-2025-39600MEDIUMWordPress Integration for WooCommerce and QuickBooks plugin <= 1.3.1 - Cross Site Request Forgery (CSRF) VulnerabilityEPSS 0.2%CVE-2025-22803MEDIUMWordPress Advanced Product Information for WooCommerce plugin <= 1.1.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-24946MEDIUMWordPress Print Invoice & Delivery Notes for WooCommerce plugin <= 5.8.0 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-62750MEDIUMWordPress WooCommerce Parcelas plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-14767MEDIUMWPC Badge Management for WooCommerce <= 3.1.6 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'text' AttributeEPSS 0.2%